8c60456b03e3fb0d8530cd6e7f9cbca2552e805d3f116b1a1d4dc10206719141

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 19:16

Target

68adb6b70e7b18246a6dc5532b6de41c6da82b4d7f2afaf25db996dc845b08b5.exe
Size

1.2MB
MD5

1033016139f3d38825bfbd26c339f15d
SHA1

82e069d37f7c43f73bb78a017fcfadb2c5ad4b11
SHA256

68adb6b70e7b18246a6dc5532b6de41c6da82b4d7f2afaf25db996dc845b08b5
SHA512

d059e6ab38c95db4fa94ce55e226312dbf8950e35234ef7495a2bffd3d52f75e01ad93fb97c9714a75a8a6bc43209b7275017baf5235b866b380e1b65335eab4
SSDEEP

24576:HPctq3/wGIlYtDk45U21iYCY0Kh0lhSMXlPaV1yjkI:vcts/wGIlkB5U2kbj/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2040	2364	68adb6b70e7b18246a6dc5532b6de41c6da82b4d7f2afaf25db996dc845b08b5.exe	30
PID 2364 wrote to memory of 2040	2364	68adb6b70e7b18246a6dc5532b6de41c6da82b4d7f2afaf25db996dc845b08b5.exe	30
PID 2364 wrote to memory of 2040	2364	68adb6b70e7b18246a6dc5532b6de41c6da82b4d7f2afaf25db996dc845b08b5.exe	30

C:\Users\Admin\AppData\Local\Temp\68adb6b70e7b18246a6dc5532b6de41c6da82b4d7f2afaf25db996dc845b08b5.exe
"C:\Users\Admin\AppData\Local\Temp\68adb6b70e7b18246a6dc5532b6de41c6da82b4d7f2afaf25db996dc845b08b5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2364 -s 164
  2⤵
  PID:2040